How to change so a "Critical Alert" is not triggered before 5 minutes of not respondin

[Arctica67]

I am sorry if this is a noob-question, but my Google skills were not good enough to find the answer.

My IT department get email alerts whenever a "Critical Alert" is created. And 99% of those are for switches and the "Device "xxx" does not respond to Ping packets". However, these are created whenever we/someone reboots a switch. I would really like to change the "Critical Alert" to happen as an example when the device have had 5 minutes of not responding to Ping packets.

How would I change this in iMC?
Thanks a lot!

[jguse]

Hello,

You could use the Maintenance Task feature for this, under Resource > Maintenance Task. You might not have this option if you are on an older version of iMC as it was added only a few versions ago if I remember correctly.

Creating a maintenance task for the device will prevent IMC from generating alarms and/or alarm e-mails during the maintenance time window. Whether or not alarms will be generated or alarm e-mails sent depends on the two options in the System Settings shown below - they should be set to No in order not to receive any alarms/mails.

[Arctica67]

Hi Justin,

Many thanks for your good suggestion, Me and my IT team will use that suggestion. But I am just curious to know, is there no way to just modify the rule for when a "critical alert" is created, for instance when a device is unavailable for  "5 minutes" or "120 lost PING in a row" or similar?

[jguse · Accepted solution]

Hello,

There is a feature called Alarm Level Configuration in the Alarm Settings that allows you to create rules which can change the severity of alarms after either a specific amount of Repetitions or Duration. Repetitions won't work for the "does not respond to ping packets" alarm, as it is generated only once after the first missed ping, and repeated failing pings only extend the duration of the same event (though it would be useful for alarms generated repeatedly from Traps). Duration could work here though.

For that you would first change the severity of the alarm via Trap Management > Trap Definition - search for OID  1.3.6.1.4.1.25506.4.1.1.2.0.1 or "poll packet" name to find it - to any severity lower than Critical. Then create an Alarm Level Configuration rule for that alarm (Selected Alarms) and add a Configuration Item for Alarm Duration.

For example add Alarm Duration of 5 (minutes) with level Critical - then iMC will change the severity of this alarm to critical 5 minutes after it appears. It wouldn't trigger if the device becomes reachable in the meantime, since that particular alarm automatically recovers itself.

Perhaps another alternative would be to set a longer ICMP polling interval in IMC, via Device Details > Configure > Modify Poll Interval > change the "Status Poll Interval". However you can't really know when the next status poll will be, so if it happens 10 seconds after your device goes down for a reboot, you'd still get an alarm.